It's important to note that CSP2 aims to mitigate this problem by adding a header that is used when CSP is active. Web applications can then be more careful abo

It's important to note that CSP2 aims to mitigate this problem by adding a header that is used when CSP is active. Web applications can then be more careful about the kind of responses they give under those conditions. https://twitter.com/mikewest/status/486048317902946304 https://twitter.com/mikewest/status/486048317902946304